Privacy Policy

Overview

Sapline is a production management platform for maple syrup and other sap-derived product operations. Sapline is operated by Brave Little Spice Company LLC, a Vermont limited liability company doing business as Sapline (“Sapline,” “we,” “us,” or “our”).

This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the rights you have over it. It applies to the Sapline web application, our public marketing website, and related services (together, the “Service”).

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

Information We Collect

Account and identity information

When you create an account or organization, we collect your name, email address, organization name, mailing address, and the state or province you operate in. Authentication is handled by our identity provider (Clerk), which provides us your name, email, sign-in timestamps, and organization membership. We assign each member a role (owner, admin, or member) within their organization.

Billing information

If you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details. We do not store your full card number. We retain your subscription tier and status, billing period dates, and the customer and subscription identifiers Stripe assigns to your organization.

Operation data you enter

The Service is built for you to record and manage your operation. This includes property and location details (including precise GPS coordinates, elevation, parcel and boundary geometry), tubing network layouts, sap collection logs, syrup production records, prices, expenses and other financial figures, equipment and maintenance records, bulk and bottling and retail lot records, and compliance documents and generated policies. Your operation data belongs to you.

Precise location and geospatial data

Because the Service maps your sugarbush, properties, tubing, and collection points, we store precise geographic coordinates and boundaries that you create or import. This location data can be sensitive; we treat it as confidential to your organization.

Information about other people that you enter

Some features let you record information about third parties, for example business contacts (buyers, suppliers, and crew, including their names, companies, email addresses, phone numbers, and addresses), visitor logs, employee training records, and the names of people who perform pest-control or other logged tasks. When you enter another person’s information, you are responsible for having a lawful basis to provide it to us and, where required, for informing them. We process this information on your behalf to provide the Service.

Uploaded documents and images

When you upload documents or images (for example receipts, certificates, or records), we store the files with our storage provider (Cloudflare R2). To extract text from an uploaded image, the image is transmitted to an optical character recognition (OCR) provider (Groq by default). We use only the extracted text within the Service.

Land Link marketplace (optional)

If you choose to participate in Land Link (our feature that connects landowners with producers), we collect the information you submit, which may include a landowner’s name, email, phone number, coarse location (town, county, state), an optional approximate map point, and acreage or tap estimates. We use this information only to facilitate introductions between interested parties, as described in the sharing section below.

Technical and usage information

When you use the Service, we automatically collect technical information such as your browser type, device information, IP address, and usage activity. If enabled, our error-monitoring provider (Sentry) records diagnostic information to help us find and fix problems. When you are signed in, this includes identifiers such as your user ID, email address, and organization ID, so we can trace an error to the affected account. When we retrieve weather data for your location, your coordinates are sent to our weather data providers.

Cookies and analytics

The Sapline web application uses only the cookies necessary to keep you signed in and to operate the Service securely.

Our public marketing website uses analytics to understand how visitors use the site. We use Plausible, a privacy-focused analytics tool that does not use cookies, does not collect personal information, and does not track you across sites; it runs by default to give us aggregate visit statistics. If Google advertising is enabled, Google’s tag (gtag.js) also loads by default with Google Consent Mode set to “denied,” so no advertising or analytics cookies are stored and no advertising identifiers are shared unless you opt in through our cookie consent banner. In this denied state, Google still receives limited cookieless measurement signals. You can change your choice at any time through the banner.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and secure the Service and your account.
• Authenticate you and manage your organization and roles.
• Process payments and manage subscriptions.
• Send you transactional messages (for example account, billing, and security notices) and product updates, and provide customer support.
• Operate features you use, including mapping, weather integration, document text extraction, and Land Link introductions.
• Improve the Service, including our sap-flow prediction models. Model improvement uses aggregated and de-identified data, not information that identifies you.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our agreements.
• With your consent, measure the effectiveness of our marketing.

We rely on the following bases to process your information: to perform our contract with you; our legitimate interests in operating and improving the Service; your consent (for non-essential cookies and marketing); and compliance with our legal obligations.

Service Providers and Subprocessors

We share information with trusted service providers who process it on our behalf, only as needed to provide the Service and under obligations of confidentiality and data protection. We do not sell your personal information.

We may add or change service providers over time. When we do, we hold new providers to comparable data-protection standards and update this table.

Cookies and Advertising

Essential cookies keep you signed in and secure the Service; these are always active because the Service cannot function without them.

Our marketing website uses Plausible for aggregate analytics; it is cookieless, does not collect personal information, and does not track you across sites, so it runs without setting cookies and is not gated by the consent banner. If Google advertising is enabled, its tag loads by default with all advertising and analytics consent signals set to “denied”: no advertising or analytics cookies are stored and no advertising identifiers are shared until you opt in through the banner, although Google still receives limited cookieless measurement signals in this state. You can withdraw or change your consent at any time using the banner.

How We Share and Disclose Information

We share information in the following circumstances:

• With service providers, as described above, to operate the Service.
• Within your organization, with other members according to their roles.
• For Land Link introductions, when you opt in, to facilitate contact between interested landowners and producers.
• For legal reasons, when we believe disclosure is required to comply with law, legal process, or a lawful government request, or to protect the rights, safety, or property of Sapline, our users, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change.
• With your consent, for any other purpose disclosed to you at the time.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising except through the consent-based advertising technologies described above, which you control.

Data Retention

We keep your information for as long as your account is active and as needed to provide the Service. If you close your account, we delete your personal information within 30 days, except where we are required to retain it for legal, tax, or accounting purposes, or to resolve disputes and enforce our agreements. De-identified, aggregated data (which does not identify you) may be retained to improve our prediction models. Backups are cycled out of storage on a rolling basis.

Data Security

We implement industry-standard measures to protect your information, including encryption in transit and at rest, access controls, isolation of each organization’s data, least-privilege access for our systems, and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your Rights and Choices

You can access and update much of your information directly in the Service, export or download your operation data where an export option is available, request a copy of your data by contacting us, and manage your communication preferences. You may also close your account, which triggers deletion as described in Data Retention. To exercise any right described below, contact us at privacy@sapline.io. We will verify your request, respond within the time required by applicable law, and will not discriminate against you for exercising your rights.

For California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt outof the sale or sharing of personal information. We do not sell your personal information. Any advertising technologies that could be considered “sharing” operate only with your consent, which you can withdraw through our cookie banner.
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes beyond providing the Service.

In the preceding 12 months, we have collected the following categories of personal information: identifiers (such as name, email, and IP address), commercial information (such as subscription and billing records), geolocation data (such as property coordinates you enter), internet or network activity (such as usage data), and professional or employment-related information (such as organization and role). We disclose these categories to the service providers listed above for the business purposes described in this policy. We do not sell personal information. You may submit a request yourself or through an authorized agent, and we will verify your identity before responding.

For Canadian residents (PIPEDA and Quebec Law 25)

If you are in Canada, you have the right to:

• Access the personal information we hold about you and request a copy.
• Correct or rectify inaccurate or incomplete personal information.
• Withdraw consent to our processing, subject to legal or contractual restrictions.
• Portability, where applicable, to receive personal information you provided in a structured, commonly used technological format (Quebec Law 25).
• Complainto the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information (CAI).

We are accountable for the personal information under our control and process it only for the purposes described in this policy. Sapline’s prediction features produce operational forecasts about sap flow and production; they are decision-support tools and do not make automated decisions that produce legal or similarly significant effects about individuals. Because our service providers are located primarily in the United States, personal information of Canadian residents is transferred to and processed in the United States, with contractual and organizational safeguards intended to provide a comparable level of protection.

International Transfers

We operate and store data primarily in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate, which may have different data-protection laws than your jurisdiction.

Children’s Privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

Contact Us

If you have questions about this policy or your data, contact us at privacy@sapline.io. Sapline is operated by Brave Little Spice Company LLC (dba Sapline).